CVE-2026-68156

CVE CVE-2026-68156EUVD EUVD-2026-55542Published 2026-08-10T11:59:22.000Z

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: libceph: refresh auth->authorizer_buf{,_len} after authorizer update ceph_x_create_authorizer() caches au->buf->vec.iov_base and au->buf->vec.iov_len in struct ceph_auth_handshake. These cached values are then used by the messenger connect code when sending the authorizer. ceph_x_update_authorizer() can rebuild the authorizer when a newer service ticket is available. If the rebuilt authorizer no longer fits in the existing buffer, ceph_x_build_authorizer() drops its reference to au->buf and allocates a new one. If this is the final reference, ceph_buffer_put() frees the old ceph_buffer and its vec.iov_base, but auth->authorizer_buf still points at that freed memory. A subsequent msgr1 reconnect can therefore queue the stale pointer and trigger a KASAN slab-use-after-free in _copy_from_iter() while tcp_sendmsg() copies the authorizer. Refresh auth->authorizer_buf and auth->authorizer_buf_len after a successful authorizer rebuild so the messenger sends the current buffer.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

Linux — Linux d2c7223497cf8228416c70e3f4238ddd6c5bdf3c; patch: 6.6.148; patch: 7.1.6; patch: 6.12.101; 29c65a277a64645af853e8c9a9b3dda0ddc421e0; 0bed9b5c523d577378b6f83eab5835fe30c27208 <75e82e8944ac1efe9fdb88bd2f14d9a031282bdf; 0bed9b5c523d577378b6f83eab5835fe30c27208 <5ecfcd5c05866f185357700b81b461dae4f5ebb2; 0bed9b5c523d577378b6f83eab5835fe30c27208 <937d61f86d377a3aa578adae7a3dfcecdddf9d89; 0bed9b5c523d577378b6f83eab5835fe30c27208 <9d37aec9ffe4e743dabc3f84502e9723e17a30d4; patch: 0; patch: 6.18.42; patch: 7.2-rc5; 3.4.50 <3.5; 3.9.7 <3.10; 3.10; 0bed9b5c523d577378b6f83eab5835fe30c27208 <0060ec912292a550198d8d18ac95b433c92a7091

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

Linux — Linux

Does this concern one of your customers?

This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.

Try it for 28 days

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.